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FOREWORD 


1 .  This  tailoring  document  defines  the  Government’s  requirements  and  expectations  for  contractor 
performance  in  defense  system  acquisitions  and  technology  developments. 

2.  This  SMC  document  was  developed  by  the  SMC/EN  Risk  Management  Advisor  and  comprises 
tailoring  to  the  risk  management  requirements  of  SMC-S-001  (2013),  Systems  Engineering 
Requirements  and  Products.  This  revision  contains  the  following  changes: 

•  Added  a  risk  management  planning  process  in  section  4.2.4. 1.1. 

•  Corrected  minor  typographical  items  throughout  to  improve  readability. 


3.  Beneficial  comments  (recommendations,  changes,  additions,  deletions,  etc.)  and  any  pertinent 
data  that  may  be  of  use  in  improving  this  document  should  be  forwarded  to  the  following  addressee 
using  the  Standardization  Document  Improvement  Proposal  appearing  at  the  end  of  this  document  or  by 
letter: 

Division  Chief,  SMC/ENE 
SPACE  AND  MISSILE  SYSTEMS  CENTER 
Air  Force  Space  Command 
483  N.  Aviation  Blvd. 

El  Segundo,  CA  90245 

4.  This  tailoring  document  has  been  approved  for  use  on  all  Space  and  Missile  Systems  Center/Air 
Force  Program  Executive  Office  -  Space  development,  acquisition,  and  sustainment  contracts. 


Mr.  David  Davis,  GG-15,  DAF 
SMC  Chief  Systems  Engineer 


Mr.  Thomas  Fitzger; 

SMC  Director  of  Efigineering 


SMC/ENE 
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The  following  paragraphs  shall  replace  section  4.2. 1.4,  Risk  Management,  and  subordinate  sections 

4.2. 1.4.1  and  4.2. 1.4. 1.1  ofSMC-S-001  (20 13),  Systems  Engineering  Requirements  and  Products. 

4.2. 1.4  Risk  Management 

The  contractor  shall  establish  and  implement  a  risk  management  program  that  includes  and  integrates 

the  required  systems  engineering  considerations  specified  in  this  document. 

4.2. 1.4.1  Required  Products 

a.  Risk  Management  Plan 

b.  Risk  List 

4.2. 1.4. 1.1  Required  Product  Attributes 

a.  The  Risk  Management  Plan: 

(1)  Specifies  a  process  that  plans  and  documents  the  risk  management  process, 
identifies  and  adjudicates  candidate  risks,  analyzes  approved  risks,  develops 
and  implements  risk  handling  plans  for  all  medium  and  high  risks  (and 
selected  low  risks),  monitors  progress  associated  with  the  implemented  risk 
handling  plans  and  feeds  this  infonnation  back  to  prior  process  steps,  and 
documents  risk  infonnation). 

(2)  Includes  a  risk  management  planning  process  step  that  incorporates  items  necessary 
to  develop,  implement,  and  document  the  risk  management  program  via  a  Risk 
Management  Plan  (RMP)  or  equivalent.  Relevant  items  may  include  a  description 
of  the  risk  management  process  steps  (with  inputs,  tools  and  techniques,  and  outputs 
per  step),  candidate  risk  categories,  ground  rules  and  assumptions,  roles  and 
responsibilities  for  implementing  risk  management,  risk  board(s)  and  membership(s) 
as  appropriate,  metrics  for  monitoring  and  evaluating  risk  management  results, 
provisions  for  risk  management  training,  a  description  of  risk  management  software 
used  and/or  templates  for  risk  reports  and  reviews,  and  references. 

(3)  Includes  a  methodology  for  risk  identification  that  encompasses  both  top-level 
approaches  such  as  products  (e.g.,  Work  Breakdown  Structure  (WBS),  processes, 
requirements/critical  parameters,  risk  categories)  and  lower-level  approaches  (e.g., 
affinity;  brainstorming;  checklists;  critical/near-critical  path;  diagramming  methods; 
expert  opinion;  failure  and  reliability  infonnation;  lessons  learned  from  analogous 
programs;  scenario  analysis;  strengths,  weakness,  opportunities,  threats;  trigger 
questions).  See  the  Air  Force  Space  and  Missile  Systems  Center  Risk  Management 
Process  Guide,  Section  3.2,  7  December  20111  for  additional  information.  While  ad 
hoc  risk  identification  may  use  one  or  more  lower-level  approaches,  comprehensive 
risk  identification  should  use  one  or  more  top-level  approaches  coupled  with  one  or 


1  https://acc.dau. mil/CommunityBrowser.aspx?id=659959 
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more  lower-level  approaches. 

(4)  Includes  an  established  process  for  continued  identification  of  risks  throughout 
the  program  life  cycle. 

(5)  Includes  risks  associated  with  contractually  identified  variations, 
uncertainties,  and  evolutions  in  system  environments. 

(6)  Analyzes  risks  in  terms  of  the  likelihood  (probability)  of  occurrence  and  the  resulting 
consequence  (impact)  with  regards  to  cost  (including  life-cycle  costs),  schedule,  and 
technical.  If  qualitative  methodologies  are  used  (e.g.,  risk  scales),  the  likelihood  and 
consequence  values  are  estimated  and  converted  to  risk  levels  (low,  medium,  and 
high)  using  the  maximum  of  the  resulting  likelihood  value(s)  and  the  maximum  of 
the  three  consequence  values  (cost,  schedule,  and  technical)  with  a  risk  mapping 
matrix  (e.g.,  AFPAM  63-128,  20092,  Figure  12.2).  (Note:  Mathematical  operations 
performed  on  likelihood  and  consequence  values  may  yield  erroneous  results.)  The 
qualitative  risk  analysis  includes  cost,  schedule,  and  technical  (including  but  not 
limited  to  design,  manufacturing,  support,  technology,  and  threat)  uncertainties  and 
sensitivity  to  program,  product,  and  process  assumptions.  The  qualitative  risk 
analysis  also  includes  a  methodology  for  prioritizing  risks  that  have  identical 
likelihood  and  consequence  values. 

(7)  Cost,  performance,  and  schedule  risks  are  analyzed  using  appropriate  quantitative 
methods  (e.g.,  Monte  Carlo  simulation),  and  include  uncertainties  and  sensitivity  to 
program,  product,  and  process  assumptions. 

(8)  Includes  the  activities  and  criteria  for  identifying,  analyzing,  validating,  and 
transitioning  critical  technologies  from  technology  development  and  demonstration 
programs,  including  commercially  developed  technologies. 

(9)  Includes  technology  readiness  level  (TRL)  in  performance,  affordability,  and  life- 
cycle  processes  in  the  criteria.  (Note:  TRL  and  other  readiness  level  scores  are  not 
risk  because  they  are  unrelated  to  the  consequence  dimension.  They  are,  however, 
indicators  of  portions  of  the  probability  dimension  of  risk.) 

(10)  Includes  a  structured  process  for  evaluating  risk  handling  options  and  developing  a 
risk  handling  strategy  (option  plus  implementation  approach).  At  a  minimum,  the 
assumption  (acceptance),  avoidance,  control  (mitigation),  and  transfer  options  should 
be  examined,  the  “best”  option  selected,  and  a  suitable  implementation  approach 
developed  for  that  option  (or  hybrid  of  multiple  options). 

(11)  Includes  an  approach  for  developing  risk  handling  plans  for  all  medium  and  high  risks 
and  selected  low  risks.  Resources  necessary  to  implement  each  activity  contained  in 
the  risk  handling  plan  should  be  identified  and  specified  whether/not  this  resource  is 
part  of  the  baseline  program.  Low  risks  not  requiring  risk  handling  plans  are 


2  http://www.e-publishing.af.mil/  [search  for  “AFPAM63-128”] 
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documented  in  a  program  watch  list  and  periodically  re-evaluated  to  ensure  that 
suitable  progress  is  being  made  to  either  close  the  risk  or  reduce  it  to  an  acceptable 
level. 

(12)  Includes  secondary  risk  handling  strategies  for  moderate  and  high  risks  as  appropriate. 

(13)  Includes  a  methodology  for  periodically  monitoring  (e.g.,  monthly,  and  at  other  times 
when  needed)  actual  vs.  planned  progress  for  implemented  risk  handling  plans  in  terms 
of  risk  likelihood  and  consequence  scores  (and  risk  level),  and  appropriate  metrics  and 
technical  performance  measures  (TPMs).  This  information  is  fed  back  to  update  the: 

1)  risk  handling  plans,  2)  risk  analysis  results,  3)  risk  identification  information,  and  4) 
risk  management  planning  as  needed. 

b.  The  Risk  List: 

(1)  Includes  suitable  documentation  for  all  low,  medium,  and  high  risks,  and  all  risk 
identification,  risk  analysis,  risk  handling,  and  risk  monitoring  information. 

(2)  Includes  a  separate  list  of  all  watch  list  items.  The  resulting  risk  lists  are 
maintained  in  a  suitable  database  that  will  permit  interrogation  of  and  updates  to 
information  over  the  life  of  the  program. 
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